Step 1: Configuring single sign-on settings in License Metric Tool

Edit online

As the first step, configure single sign-on settings in License Metric Tool.

Before you begin

Gather necessary information

Before you start the configuration, gather one of the following sets of information:

The IdP metadata XML file
Fetch the file from the endpoint URL of federation metadata endpoint. In case of ADFS, the URL is: https://<ADFS-FQDN>/FederationMetadata/2007-06/FederationMetadata.xml.
The following three items:
- URL to the login page of the Identity Provider. It is the URL to which an unauthenticated request is redirected. After the request is authenticated by the Identity Provider, the user is redirected to License Metric Tool.
  For example: https://ADFS_host_name/adfs/ls/IdPInitiatedSignOn.aspx?LoginToRP=https://LMT_host_name:9081/ibm/saml20/defaultSP.
- URL of the Trusted Issuer. It is the URL to the certificate issuer of the Identity Provider that is needed to establish a trust relationship.
  For example, http://ADFS_host_name/adfs/services/trust.
- Public certificate of the Identity Provider in the key_name.cer format.

Backup files

Before you start configuring single sign-on, back up the following files:

server.xml
- lmt_install_dir/wlp/usr/servers/server1
- lmt_install_dir\wlp\usr\servers\server1
web.xml
- lmt_install_dir/wlp/usr/servers/server1/apps/tema.war/WEB-INF
- lmt_install_dir\wlp\usr\servers\server1\apps\tema.war\WEB-INF

Create users

Create License Metric Tool users who will use the single sign-on. During the creation of the users, select Single Sign-on as the authentication method. Ensure that all user names are fully-qualified names that contain the full domain name, for example: user@domain.example. Also, ensure that at least one user is an Administrator.

Linux If the License Metric Tool server is installed on Linux, and users in the Identity Provider use the camel-case naming convention, create users following the same convention in License Metric Tool. Otherwise, the users are not be able to generate audit snapshots.

Note: User token is not available after a single sign-on user is created. If you need the token, for example to run REST API calls, ask the License Metric Tool administrator to provide it for you.

Procedure

Log in to License Metric Tool, and click Management > Single Sign-On Settings.
In the Method field, select SAML.
In the SAML Setup Method field, select the setup method.
- If you select Based on IdP Metadata, browse for the IdP metadata XML file.
- If you select Custom Setup, perform the following steps.
  1. In the Login Page URL field, specify the URL to the login page of the Identity Provider that you will use to single sign-on to License Metric Tool.
    For example:
```
https://ADFS_host_name/adfs/ls/IdPInitiatedSignOn.aspx?LoginToRP=https://LMT_host_name:9081/ibm/saml20/defaultSP
```
    Important: Ensure that the URL that you specify is correct. The address is not validated. If you make a typo in the URL, you might need to manually revert the SSO configuration.
  2. In the Identity Provider Certificate field, provide the public certificate of the Identity Provider. Click Browse to locate the key_name.cer certificate that you created.
  3. In the Trusted Issuer URL (previously:Trusted Issuer) field, provide the URL of the certificate issuer of the Identity Provider. It is the issuer name of the Identity Provider as it appears in the SAML assertion.
    For example:
```
http://ADFS_host_name/adfs/services/trust
```
    Important: Ensure that the URL that you specify is correct. The address is not validated. If you make a typo in the URL, you might need to manually revert the SSO configuration.
Click Save.
Optional: To use a custom certificate for the SSO setup, see: Using a CA-signed (custom) certificate for SSO based on SAML. Otherwise, continue to the next step.
Click the Download Service Provider Metadata link, and save the spMetadata.xml file.

Tip: If the panel is incomplete or does not reload, restart the License Metric Tool server.
Optional: Validate that the entityID URL in the spMetadata.xml file can be accessed from the Identity Provider location.

What to do next

Based on the spMetadata.xml file, configure Identity Provider for single sign-on.